US 12,149,551 B2
Log anomaly detection in continuous artificial intelligence for it operations
Lu An, Raleigh, NC (US); An-Jie Andy Tu, Campbell, CA (US); Xiaotong Liu, San Jose, CA (US); Anbang Xu, San Jose, CA (US); Rama Kalyani T. Akkiraju, Cupertino, CA (US); and Neil H. Boyette, Oregon City, OR (US)
Assigned to International Business Machines Corporation, Armonk, NY (US)
Filed by International Business Machines Corporation, Armonk, NY (US)
Filed on Sep. 9, 2022, as Appl. No. 17/930,729.
Prior Publication US 2024/0089275 A1, Mar. 14, 2024
Int. Cl. H04L 9/40 (2022.01); G06F 11/16 (2006.01); G06F 18/2411 (2023.01); H04L 41/0604 (2022.01); H04L 41/0631 (2022.01); H04L 43/0817 (2022.01)
CPC H04L 63/1425 (2013.01) [G06F 11/16 (2013.01); G06F 18/2411 (2023.01); H04L 41/0627 (2013.01); H04L 41/0645 (2013.01); H04L 43/0817 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method for real-time statistical model based log anomaly detection, the method comprising:
receiving a windowed log of incoming raw log messages from a data source, the windowed log being as an inference input for log anomaly detection;
comparing statistical distribution metrics of entities in the windowed log with a statistical distribution extracted from a real-time statistical model for the entities, the entities being extracted from the incoming raw log messages and including message identifiers, log levels, error codes, and exception types;
in response to determining the statistical distribution metrics of the entities being statistically different from the statistical distribution extracted from the real-time statistical model for the entities, tagging the windowed log as an entity anomaly;
computing a distance between an average word embedding vector in the windowed log and a statistical distribution extracted form a real-time statistical model for word embeddings;
in response to determining the distance being greater than a predetermined threshold of the distance, tagging the windowed log as a word embedding anomaly; and
sending to a user an alert with an anomaly severity level.